IBM i EUVD-2026-57517

Exploitation requires a valid IBM i user account; CVSS PR:L confirms that any low-privilege authenticated user is sufficient - no administrative or special authority is needed. The attacker must have network-layer access to the specific IBM i service or interface containing the flaw. No non-default configuration is described as a prerequisite, meaning any IBM i 7.3-7.6 system with the vulnerable network service reachable is potentially at risk. Exploitation is constrained by the authentication requirement: unauthenticated external attackers cannot exploit this flaw directly without first obtaining credentials. The specific IBM i subsystem, port, or CL interface affected is not named in available data, which limits precise network-layer scoping of compensating controls.

The CVSS 8.8 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable flaw requiring only low-privilege authenticated access, no user interaction, and no special conditions - yielding full C/I/A compromise. The description and CVSS vector are fully consistent; no conflicting signals are present. No EPSS data was provided, so exploitation probability cannot be quantified. No CISA KEV listing means active exploitation is unconfirmed. No public POC has been identified, which modestly reduces urgency versus the raw score. However, IBM i systems routinely host critical transactional and financial data in enterprise environments; the minimal authentication requirement (any valid user account suffices) means credential theft or brute force of a weak account is the only prerequisite. This warrants high-priority patching on any IBM i system with the vulnerable service accessible over the network.

An attacker who has acquired low-privilege IBM i credentials - through phishing, credential stuffing, or compromise of an integrated application account - connects over the network to the vulnerable IBM i service and submits input containing shell metacharacters such as a semicolon or pipe followed by an arbitrary command. The IBM i system fails to sanitize the metacharacters, causing the embedded command to be executed in the context of the service process. No public proof-of-concept code has been identified, but the standard nature of CWE-78 exploitation means the technique is well understood by attackers.